1. Home
  2. CVE Database
  3. CVE-2023-3612
HIGH · 8.2

CVE-2023-3612

Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context o...

Vulnerability Description

Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context of WebView or steal sensitive user data by displaying phishing content.

CVSS Score

8.2

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
GoveeHome< 5.8.01

Related Weaknesses (CWE)

CWE-749

References

FAQ

What is CVE-2023-3612?

CVE-2023-3612 is a vulnerability with a CVSS score of 8.2 (HIGH). Govee Home app has unprotected access to WebView component which can be opened by any app on the device. By sending an URL to a specially crafted site, the attacker can execute JavaScript in context o...

How severe is CVE-2023-3612?

CVE-2023-3612 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-3612?

Check the references section above for vendor advisories and patch information. Affected products include: Govee Home.